Proving Soundness of Extensional Normal-Form Bisimilarities

10/31/2017 ∙ by Dariusz Biernacki, et al. ∙ Université Lorraine Akademia Sztuk Pięknych we Wrocławiu 0

Normal-form bisimilarity is a simple, easy-to-use behavioral equivalence that relates terms in lambda-calculi by decomposing their normal forms into bisimilar subterms. Besides, they allow for powerful up-to techniques, such as bisimulation up to context, which simplify bisimulation proofs even further. However, proving soundness of these relations becomes complicated in the presence of eta-expansion and usually relies on ad hoc proof methods which depend on the language. In this paper we propose a more systematic proof method to show that an extensional normal-form bisimilarity along with its corresponding bisimulation up to context are sound. We illustrate our technique with three calculi: the call-by-value lambda-calculus, the call-by-value lambda-calculus with the delimited-control operators shift and reset, and the call-by-value lambda-calculus with the abortive control operators call/cc and abort. In the first two cases, there was previously no sound bisimulation up to context validating the eta-law, whereas no theory of normal-form bisimulations for the calculus of abortive control has been presented before. Our results have been fully formalized in the Coq proof assistant.



There are no comments yet.


page 1

page 2

page 3

page 4

This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

1. Introduction

In formal languages inspired by the -calculus, the behavioral equivalence of choice is usually formulated as a Morris-style contextual equivalence [25]: two terms are equivalent if they behave the same in any context. This criterion captures quite naturally the idea that replacing a term by an equivalent one in a bigger program should not affect the behavior of the whole program. However, the quantification over contexts makes contextual equivalence hard to use in practice to prove the equivalence of two given terms. Therefore, it is common to look for easier-to-use, sound alternatives that are at least included in contextual equivalence, such as coinductively defined bisimilarities.

Different styles of bisimilarities have been defined for the -calculus, including applicative bisimilarity [1], normal-form bisimilarity [18] (originally called open bisimilarity in [29]), and environmental bisimilarity [30]. Applicative and environmental bisimilarities compare terms by applying them to function arguments, while normal-form bisimilarity reduces terms to normal forms, which are then decomposed into bisimilar subterms. As we can see, applicative and environmental bisimilarities still rely on some form of quantification over arguments, which is not the case of normal-form bisimilarity. As a drawback, the latter is usually not complete w.r.t. contextual equivalence—there exist contextually equivalent terms that are not normal-form bisimilar—while the former are. Like environmental bisimilarity, normal-form bisimilarity usually allows for up-to techniques [27], relations which simplify equivalence proofs of terms by having less requirements than regular bisimilarities. For example, bisimulation up to context allows to forget about a common context: to equate and , it is enough to relate and with a bisimulation up to context.

In the call-by-value -calculus, the simplest definition of normal-form bisimilarity compares values by equating a variable only with itself, and a -abstraction only with a -abstraction such that their bodies are bisimilar. Such a definition does not respect call-by-value -expansion, since it distinguishes from . A less discriminating definition instead compares values by applying them to a fresh variable, thus relating and for any value  such that is not free in : given a fresh , reduces to . Such a bisimilarity, that we call extensional bisimilarity,111Lassen uses the term bisimilarity up to  [17] for a normal-form bisimilarity that validates the -law, but we prefer the term extensional bisimilarity so that there is no confusion with notions referring to up-to techniques such as bisimulation up to context. relates more contextually equivalent terms, but proving its soundness as well as proving the soundness of its up-to techniques is more difficult, and usually requires ad hoc proof methods, as we detail in the related work section (Section 2).

Madiot et al. [23] propose a framework where proving the soundness of up-to techniques is quite uniform and simpler. It also allows to factorize proofs, since showing that bisimulation up to context is sound directly implies that the corresponding bisimilarity is a congruence, which is the main property needed for proving its soundness. Madiot et al. apply the method to environmental bisimilarities for the plain call-by-name -calculus and for a call-by-value -calculus with references, as well as to a bisimilarity for the -calculus. In a subsequent work [3], we extend this framework to define environmental bisimilarities for a call-by-value -calculus with multi-prompted delimited-control operators. We propose a distinction between strong and regular up-to techniques, where regular up-to techniques cannot be used in certain bisimilarity tests, while strong ones can always be used. This distinction allows to prove sound more powerful up-to techniques, by forbidding their use in cases where it would be unsound to apply them.

So far, the method developed in [23, 3] have been used in the -calculus only for environmental bisimilarities. In this paper, we show that our extended framework [3] can also be used to prove the soundness of extensional normal-form bisimilarities and their corresponding bisimulation up to context. We first apply it to the plain call-by-value -calculus, in which an extensional normal-form bisimilarity, albeit without a corresponding bisimulation up to context, have already been proved sound [18], to show how our framework allows to prove soundness for both proof techniques at once. We then consider a call-by-value -calculus with the delimited-control operators and  [10], for which there has been no sound bisimulation up to context validating the -law either, and we show that our method applies seamlessly in that setting as well. Finally, we address a calculus of abortive control, i.e., the call-by-value -calculus with and  [12, 13], for which there has been no theory of normal-form bisimulations before. Regarding this last result, not only does it confirm robustness of the proof method we advocate in this article, but it also provides a new operational technique for reasoning about classical calculi of abortive continuations introduced by Felleisen et al.

Our results have been fully formalized in the Coq proof assistant, thus increasing the confidence in proofs that can be quite meticulous. The Coq developments, available at, use a de Bruijn representation for -terms, where the de Bruijn indices are encoded using nested datatypes [9].

The paper is organized as follows: in Section 2, we discuss the previous proofs of soundness of extensional normal-form bisimilarities. In Section 3, we present the proof method for the call-by-value -calculus, that we then apply to the -calculus with delimited control in Section 4, and to the -calculus with abortive control in Section 5. We conclude in Section 6. Compared to the conference article [8], Section 5 is entirely new, whereas the remaining sections have been revised.

2. Related Work

Normal-form bisimilarity has been first introduced by Sangiorgi [29] and has then been defined for many variants of the -calculus, considering -expansion [17, 18, 20, 31, 21, 22, 6, 7] or not [16, 19]. In this section we focus on the articles treating the -law, and in particular on the congruence and soundness proofs presented therein.

In [17], Lassen defines several equivalences for the call-by-name -calculus, depending on the chosen semantics. He defines head-normal-form (hnf) bisimulation and hnf bisimulation up to  for the semantics based on reduction to head normal form (where -expansion applies to any term , not only to a value as in the call-by-value -calculus), and weak-head-normal-form (whnf) bisimulation based on reduction to weak head normal form. (It does not make sense to consider a whnf bisimulation up to , since it would be unsound, e.g., it would relate a non-terminating term with a normal form .) The paper also defines a bisimulation up to context for each bisimilarity.

The congruence proofs for the three bisimilarities follow from the main lemma stating that if a relation is a bisimulation, then so is its substitutive and context closure. The lemma is proved by nested induction on the definition of the closure and on the number of steps in the evaluation of terms to normal forms. It can be easily strengthened to prove the soundness of a bisimulation up to context: if a relation is a bisimulation up to context, then its substitutive and context closure is a bisimulation. The nested induction proof method has been then applied to prove congruence for a whnf bisimilarity for the call-by-name -calculus [16] (a calculus with continuations), an extensional hnf bisimilarity for the call-by-name -calculus with pairs [20], and a whnf bisimilarity for a call-by-name -calculus with McCarthy’s ambiguous choice (amb) operator [19]. These papers do not define any corresponding bisimulation up to context.

Lassen uses another proof technique in [18], where he defines an eager normal form (enf) bisimilarity and an enf bisimilarity up to .222While weak head normal forms are normal forms under call-by-name evaluation, eager normal forms are normal forms under call-by-value evaluation of -terms. Lassen shows that the bisimilarities correspond to Böhm trees equivalence (up to ) after a continuation-passing style (CPS) translation, and then he deduces congruence of the enf bisimilarities from the congruence of the Böhm trees equivalence. A CPS-translation based technique has also been used in [20] to prove congruence of the extensional bisimilarity for the call-by-name -calculus (also with surjective pairing), the -calculus, and the -calculus. Unlike the nested induction proof method, this technique does not extend to a soundness proof of a bisimulation up to context.

In [18], Lassen claims that “It is also possible to prove congruence of enf bisimilarity and enf bisimilarity up to directly like the congruence proofs for other normal form bisimilarities (tree equivalences) in [17], although the congruence proofs (…) require non-trivial changes to the relational substitutive context closure operation in op.cit. (…) Moreover, from the direct congruence proofs, we can derive bisimulation “up to context” proof principles like those for other normal form bisimilarities in op.cit.” To our knowledge, such a proof is not published anywhere; we tried to carry out the congruence proof by following this comment, but we do not know how to conclude in the case of enf bisimilarity up to . We discuss what the problem is at the end of the proof of Lemma 3.3.

Støvring and Lassen [31] define extensional enf bisimilarities for three calculi: (continuations), (mutable state), and (continuations and mutable state). The congruence proof is rather convoluted and is done in two stages: first, prove congruence of a non-extensional bisimilarity using the nested induction of [17], then extend the result to the extensional bisimilarity by a syntactic translation that takes advantage of an infinite -expansion combinator. The paper does not mention bisimulation up to context.

Lassen and Levy [21, 22] define a normal-form bisimilarity for a CPS calculus called JWA equipped with a rich type system (including product, sum, recursive types; [22] adds existential types). The bisimilarity respects the -law, and the congruence proof is done in terms of game semantics notions. Again, these papers do not mention bisimulation up to context.

In a previous work [6], we define extensional enf bisimilarities and bisimulations up to context for a call-by-value -calculus with delimited-control operators. The (unpublished) congruence and soundness proofs follow Lassen [17], but are incorrect: one case in the induction, that turns out to be problematic, has been forgotten. In [7] we fix the congruence proof of the extensional bisimilarity, by doing a nested induction on a different notion of closure than Lassen. This approach fails when proving soundness of a bisimulation up to context, and therefore bisimulation up to context does not respect the -law in [7].

To summarize:

  • The soundness proofs for extensional hnf bisimilarities are uniformly done using a nested induction proof method [17, 20]. The proof can then be turned into a soundness proof for bisimulation up to context.

  • The soundness proofs of extensional enf bisimilarities either follow from a CPS translation [18, 20], or other ad hoc arguments [31, 21, 22, 7] which do not carry over to a soundness proof for a bisimulation up to context.

  • The only claims about congruence of an extensional enf bisimilarity as well as soundness of the corresponding bisimulation up to context using a nested induction proof are either wrong [6] or are not substantiated by a presentation of the actual proof [18]. The reason the nested induction proof works for extensional hnf bisimilarities and not for extensional enf bisimilarities stems from the difference in the requirements on the shape of -abstractions the two normal forms impose: whereas the body of a -abstraction in hnf is also a hnf, the body of a -abstraction in enf is an arbitrary term.

In this paper, we consider an extensional enf bisimilarity for three calculi: the plain -calculus and its extensions with delimited and abortive continuations, and in each case we present a soundness proof of the corresponding enf bisimulation up to context from which congruence of the bisimilarity follows.

3. Call-by-value -calculus

We introduce a new approach to normal-form bisimulations that is based on the framework we developed previously [3]. The calculus of discourse is the plain call-by-value -calculus.

3.1. Syntax, semantics, and normal-form bisimulations

We let , , range over variables. The syntax of terms (, ), values (, ), and call-by-value evaluation contexts () is given as follows:

An abstraction binds in ; a variable that is not bound is called free. The set of free variables in a term is written . We work modulo -conversion of bound variables, and a variable is called fresh if it does not occur in the terms under consideration. Contexts are represented outside-in, and we write for plugging a term in a context. We write for the capture-avoiding substitution of for  in . We write successive -abstractions as .

We consider a call-by-value reduction semantics for the language

We write for the reflexive and transitive closure of , and if and cannot reduce; we say that evaluates to .

Eager normal forms are either values or open stuck terms of the form . Normal-form bisimilarity relates terms by comparing their normal forms (if they exist). For values, a first possibility is to relate separately variables and -abstractions: a variable can be equated only to , and is bisimilar to if is bisimilar to . As explained in the introduction, this does not respect -expansion: the -respecting definition compares values by applying them to a fresh variable. Given a relation on terms, we reflect how values and open stuck terms are tested by the relations , , and , defined as follows:

v x w x
x fresh v w E x E’ x
x fresh E E’ E E’
v w E x v E’x w

Remark .

Traditionally, normal-form bisimulations are construed as an open version of applicative bisimulations in that they test values by applying them to a free variable [18], rather than to all possible closed values [1]. However, a connection with Böhm or Lévy-Longo trees [17] aside, one could introduce a separate category of variables that would represent abstract values, and use these for the purpose of testing functional values. In such an approach, the reduction relation would cater for closed terms only, as far as the term variables are concerned, and the notion of an open stuck term could be replaced with a notion of a value-stuck term. In this work we stick to the traditional approach to testing functional values (witness the definition of ), but in Section 5 we propose an extension which is analogous to the one sketched in this remark, and we introduce a separate category of variables representing abstract contexts, a notion dual to that of abstract values.

We can now define (extensional) normal-form bisimulation and bisimilarity, using a notion of progress. A relation progresses to if implies:

  • if , then there exists such that and ;

  • if , then there exists such that , and ;

  • if , then there exist , such that and ;

  • the converse of the above conditions on .

A bisimulation is then defined as a relation which progresses to itself, and bisimilarity as the union of all bisimulations. Our definition is in a small-step style, unlike Lassen’s [18], as we believe small-step is more flexible, since we can recover a big-step reasoning with bisimulation up to reduction (Section 3.3). In usual definitions [18, 31, 7], the -reduction is directly performed when a -abstraction is applied to a fresh variable, whereas we construct an application in order to uniformly treat all kinds of values, and hence account for -expansion. However, with this approach a naive definition of bisimulation up to context would be unsound because it would equate any two values: if and are related, then and are related up to context. In our framework, we prevent this issue as explained after Definition 3.1.

We now recast the definition of normal-form bisimilarity in the framework of our previous work [3], which is itself an extension of a work by Madiot et al. [23, 24]. The goal is to factorize the congruence proof of the bisimilarity with the soundness proofs of the up-to techniques. The novelty in [3] is that we distinguish between active and passive clauses, and we forbid some up-to techniques to be applied in a passive clause. Whereas this distinction does not change the notions of bisimulation or bisimilarity, it has an impact on the bisimilarity congruence proof.

A relation diacritically progresses to , written , if , , and implies:

  • if , then there exists such that and ;

  • if , then there exists such that , and ;

  • if , then there exist , such that and ;

  • the converse of the above conditions on .

An normal-form bisimulation is a relation such that , and normal-form bisimilarity is the union of all normal-form bisimulations. The difference between Definitions 3.1 and 3.1 is only in the clause for values, where we progress towards a different relation than in the other clauses of Definition 3.1. We say that the clause for values is passive, while the others are active. A bisimulation progresses towards in passive and active clauses, so the two definitions generate the same bisimilarity. However, we prevent some up-to techniques from being applied in a passive clause. In particular, up to context is not allowed, as explained in Section 3.3, meaning that we cannot deduce that and are related up to context just because and are related. In contrast, we allow any up-to techniques when we test a value in the open stuck term case, since we cannot deduce from related to that and are related up to context.

Example .

Let and for a given ; note that . Wadsworth’s infinite -expansion combinator [4] can be defined as . Let be the identity bisimulation. We prove that , by showing that

is a bisimulation. Indeed, to compare and , we have to relate and , but . We then have to equate and , the latter evaluating to . To relate these open stuck terms, we have to equate  and (with ), and with , but these terms are already in . As usual, the quite lengthy definition of  can be simplified with up-to techniques (see Example 3.3). ∎

3.2. Up-to techniques, general definitions

We recall here the main definitions we use from our previous work [3]. The goal of up-to techniques is to simplify bisimulation proofs: instead of proving that a relation is a bisimulation, we show that respects some looser constraints which still imply bisimilarity. In our setting, we distinguish the up-to techniques which can be used in passive clauses (called strong up-to techniques), from the ones which cannot. An up-to technique (resp. strong up-to technique) is a function such that (resp. ) implies . Proving that a given  is an up-to technique is difficult with this definition, so following [27, 23], we rely on a notion of compatibility instead, which gives sufficient conditions for to be an up-to technique.

We first define some auxiliary notions and notations. We write if for all . We define argument-wise, i.e., , and given a set of functions, we also write  for the function defined as . We define as . We write for the identity function on relations, and for . A function  is monotone if implies . We write for the set of finite subsets of , and we say is continuous if it can be defined by its image on these finite subsets, i.e., if . The up-to techniques of the present paper are defined by inference rules with a finite number of premises, so they are trivially continuous. Continuous functions are interesting because of their properties:333Our formalization revealed an error in previous works [3, 24] which use instead of in the last property of Lemma 3.2 (expressing idempotence of )— has to be factored in for the property to hold.

If and are continuous, then and are continuous.

If is continuous, then is monotone, and .

A function evolves to , written , if for all , we have . A function strongly evolves to , written , if for all , we have . Evolution can be seen as a notion of progress for functions on relations. Note that strong evolution does not put any condition on how progresses, while regular evolution is more restricted, as it requires a relation such that .

A set of continuous functions is diacritically compatible if there exists  such that and

  • for all , we have ;

  • for all , we have .

In words, a function is in a compatible set if it evolves towards a combination of functions in . The (possibly empty) subset intuitively represents the strong up-to techniques of . Any combination of functions can be used in an active clause. In a passive one, only strong functions can be used, except in the second case, where we progress from , with not strong. In that case, it is expected to progress towards a combination that includes ; it is safe to do so, as long as (or in fact, any non-strong function in ) is used at most once. If and  are subsets of  which verify the conditions of the definition, then also does, so there exists the largest subset of which satisfies the conditions, written .

Let be a diacritically compatible set.

  • If , then is a bisimulation.

  • If , then is an up-to technique. If , then is a strong up-to technique.

  • For all , we have .

The proof takes advantage of Lemma 3.2. In practice, proving that is in a compatible set  is easier than proving it is an up-to technique. Besides, if we prove that a bisimulation up to context is compatible, then we get for free that  is preserved by contexts thanks to the last property of Lemma 3.2.

3.3. Up-to techniques for normal-form bisimilarity

Figure 1 presents the up-to techniques we define for the -calculus. Combined altogether, they define a closure as in the nested induction proof method [17, 20]; we use a more fine-grained approach to distinguish between strong and regular up-to techniques. The substitutive closure is already used in previous works [17, 20, 7]. The technique , used in the compatibility proofs, is the classic bisimulation up to reduction, which allows terms to reduce before being related.

The closure by evaluation contexts is more unconventional, although we define it in a previous work [7]. It is not the same as bisimulation up to context, since we can factor out different contexts, as long as they are related when we plug a fresh variable inside them. It is reminiscent of -bisimilarity [3] which can also factor out different contexts in its up-to techniques, except that -bisimilarity compares contexts with values and not simply variables.

Closure w.r.t. -abstraction is achieved through , and closure w.r.t. variables is a consequence of , as we have for all . Closure w.r.t. application is a consequence of and . If and , then . Let be a fresh variable; then . Combined with , it implies , i.e., . This combined with using gives the result of Lemma 3.3.

The set is diacritically compatible, with .

t t t sx t x s t s
v w t x v s x w
t s
E E’ E t E’ s t t’
s s’
t’ s’ t s

Figure 1. Up-to techniques for the -calculus

The complete proof of Theorem 3.3 can be found in the Coq formalization. We sketch some of the compatibility proofs to show how proofs are done in our framework, in particular the crucial case of , where we need the distinction between active and passive tests. We compare ourselves to Lassen’s proof [17], which proceeds by induction on the definition of the closure using Definition 3.1. We do not need an induction on the number of evaluation steps for our small-step definition, but a nested induction proof for a big-step relation would exhibit the same issues. The strong up-to techniques , , and are easy to deal with; we detail the proof for .



Let ; we want to prove that . The inclusions and hold because , (by definition of ) and the functions are monotone. Next, let such that . The only clause to check is the one for values: we have and , i.e., , which implies because and is monotone. ∎

We now sketch the proof for , which is by case analysis on the related terms.


Let , and such that and . We check the different clauses by case analysis on . If is a value, then there exists a value such that and . But then and are also values, and then we can prove that holds. If , then there exists such that and . Then , , and .

Finally, if , then there exists such that and . If , then and are open stuck terms in . Otherwise, we distinguish cases based on whether is a -abstraction or not. In the former case, let , . Then . From and , we know that there exists such that and . Consequently, we have . Then for a fresh , but also , so after plugging, we obtain terms in .

If is a variable, a similar reasoning shows that and evaluate to open stuck terms, whose contexts are related by and whose arguments are related by . ∎

The proof for does not require the clause for values to be passive, and is thus similar to the corresponding case in a proof by induction [17]. In contrast, we need testing values to be passive when dealing with ; we present the problematic subcase below. We do not know how to make this subcase go through in a proof by induction.


Let , and such that and . We proceed by case analysis on and . Most cases are straightforward; the problematic case is when  is a variable and . Because , there exists such that and . Because , we have for a fresh , and therefore . We can conclude using Lemma 3.3: there exists an open stuck term  such that and .

In an induction proof with Definition 3.1, we would have in that case instead of , and for some such that . We do not see how to go further in the case is a -abstraction: we have to prove that evaluates to an open stuck term, but we do not have any progress hypothesis about . ∎

Theorem 3.3 (, and are compatible) and Lemma 3.2 (the third item) implies that is preserved by context. As it is easy to show that is also an equivalence relation, we have the following corollary.

is a congruence.

This corollary, in turn, immediately implies the soundness of w.r.t. the usual contextual equivalence of the -calculus, where we observe termination of evaluation [1]—the notion of contextual equivalence that we take throughout the paper. However, as proved in [18] is not complete w.r.t. contextual equivalence.

Example .

We can simplify the definition of in Example 3.1 to just

and show that is a bisimulation up to and . To illustrate how bisimulation up to context can help, we define and and prove that these values are bisimilar by showing that is a bisimulation up to , , and . Indeed, we have and . To relate the two resulting values, we compare and for a fresh . These terms reduce to respectively and , which are in , because for a fresh  and . Without , we would have to reduce these terms further and continue the bisimulation game. Note that we use after a reduction step, i.e., in an active clause. We also have , but we cannot conclude with this, as we would use in the passive clause for values. ∎

4. Delimited-control operators

We show that the results of Section 3 seamlessly carry over to the call-by-value -calculus extended with and  [10, 7], thus demonstrating the robustness of the approach, but also improving on the previous results on extensional normal-form bisimulations for this calculus [7].

4.1. Syntax, semantics, and normal-form bisimulations

We extend the grammar of terms and values given in Section 3 as follows:

where is the control delimiter and is the delimited-control operator . Usually, is presented as a binder  [10, 7] or as a special form  [14], but here we choose a more liberal syntax treating as a value (as, e.g., in [15]). This makes the calculus a little more interesting since becomes a subject to -expansion just as any other value, and moreover it makes it possible to study terms such as . We call pure terms effect-free terms, i.e., values and terms of the form .

We distinguish a subclass of pure contexts () among evaluation contexts ():

We extend the function to both kinds of contexts. Note that an evaluation context  is either pure or can be written for some and . Pure contexts can be captured by , as we can see in the following rules defining the call-by-value left-to-right reduction semantics of the calculus:

The first rule is the usual call-by-value -reduction. When is applied to a value , it captures its surrounding pure context up to the dynamically nearest enclosing reset, and provides its term representation as an argument to . Finally, a reset which encloses a value can be removed, since the delimited subcomputation is finished. All these reductions may occur within a metalevel context  that encodes the chosen call-by-value evaluation strategy. As in Section 3, the reduction relation  is preserved by evaluation contexts.

Example (from [7]).

Let , , and . We present the sequence of reductions initiated by :

In step (1) the pure context , is captured and reified as a term that in step (2) is substituted for in the argument of . In step (3) the captured context is reactivated by -reduction, and thanks to the enclosing the body of the lambda representing the captured context, it is not merged with the current context, but composed with it. As a result, the capture triggered by in step (4) leaves the outer intact. 444For this reason and are called static control operators, in contrast to Felleisen’s and  [11] that are called dynamic control operators [5]. In step (5) the context captured in step (4) is discarded, again in terms of -reduction. In steps (6) and (8) a control delimiter guarding a value is removed, whereas in step (7) a regular function application takes place. Note that even though the reduction strategy is call-by-value, some function arguments are not evaluated, like the non-terminating term in this example. ∎

Example .

This example illustrates the operational behavior of as a value:

In particular, if , then the value of the initial term, after two additional reduction steps, is , i.e., the representation of the empty context in the calculus of delimited control. ∎

A term either uniquely reduces to another term, or is an eager normal form: it is either a value , an open stuck term , or a control-stuck term . The latter cannot reduce further since it lacks a reset enclosing . Because can decompose contexts, we have to change the relation as discussed in [7]:

E x E’ x
x fresh E E’ E x E’ x
Fx F’x
x fresh FE F’E’

We also introduce a relation to handle control-stuck terms:

E E’
v x w x
x fresh E v E’w

whereas the relation remains unchanged, so that it accounts for the -law, even though the values now include .

We can now define (extensional) normal-form bisimulation and bisimilarity for the extended calculus, again using the notion of diacritical progress. A relation diacritically progresses to , written , if , , and implies:

  • if , then there exists such that and ;

  • if , then there exists such that , and ;

  • if , then there exist , such that and ;

  • if , then there exist , such that and ;

  • the converse of the above conditions on .

A normal-form bisimulation is a relation such that , and normal-form bisimilarity is the union of all normal-form bisimulations. Only the clause for values is passive, as in Definition 3.1.

Example .

The terms and are bisimilar since the following relation is a normal-form bisimulation:

where is the identity relation and , , and fresh variables. In we compare two control-stuck terms, so to validate the bisimulation conditions, we have to compare the two empty contexts (which are in ) and the arguments of . Here, extensionality plays an important role, as these arguments are of different kinds ( vs a -abstraction). We compare them by passing them a fresh variable , thus we include the pair in the bisimulation. The terms of can be reduced to those in , where we compare open stuck terms, so we have to include to compare the arguments of . The terms in can then be reduced to the ones in which in turn reduce to identical terms. ∎

4.2. Up-to techniques

t s
E E’ E t E’ s t s
E E’ E t E’ s t s
t, s pure
F x F’ x
x fresh F t F’s

Figure 2. Up-to techniques specific to the -calculus extended with and

The up-to techniques we consider for this calculus are the same as in Figure 1, except we replace by three more fine-grained up-to techniques defined in Figure 2. The techniques , allow to factor out related pure contexts and pure contexts with a surrounding reset. The third one () can be used only with pure terms, but uses a naive comparison between any evaluation contexts instead of . Indeed, a pure term cannot evaluate to a control-stuck term, so decomposing contexts with  is not necessary. The usual bisimulation up to evaluation context can be obtained by composing these three up-to techniques.

If and then .

We do not define extra up-to techniques corresponding to the new constructs of the language, as is dealt with like variables—using , and closure w.r.t. can be deduced from by taking the empty context. Defining a dedicated up-to technique for would have some merit since it could be proved strong. It is not so for , as we can see in the next theorem:

The set is diacritically compatible, with .

The evolution proofs are as in the pure -calculus, by case analysis on the possible reductions that the related terms can do. The techniques , , and are not strong as they exhibit the same problematic case presented in Lemma 3.3 (for and ) or a slight variant ( and for ). As in Section 3, from Theorem 4.2 and Lemma 3.2 it follows that is a congruence, and, therefore, is sound w.r.t. the contextual equivalence of [7]; it is not complete as showed in op. cit.

Example .

With these up-to techniques, we can simplify the bisimulation of Example 4.1 to just a single pair

Indeed, we have , and , so (3) is in , where . Then, (2) is in , and for (1), we have also to relate with , thus (1) is in . As a result, is a bisimulation up to , , , and . ∎

5. Abortive Control

In contrast with delimited-control operators, abortive control operators capture the whole surrounding context and reify it as an abortive computation. As such they are considerably more challenging as far as modular reasoning is concerned in that one has to take into account reduction of complete programs, rather than of their subexpressions. In this section we apply our technique to a calculus with and  [12, 13], for which no sound normal-form bisimilarity has been defined so far.

5.1. Syntax and semantics

The syntax of the -calculus with abortive control operators () and () can be defined as the following extension of the syntax of Section 3:

with the same syntax of evaluation contexts as for the -calculus:

However, the reduction rules for abortive control operators considered in this section, unlike the ones for the pure lambda calculus or delimited control operators, are not compatible with respect to evaluation contexts, i.e., does not imply . As such they are meant to describe evaluation of complete programs. In order to reflect this requirement, we introduce a separate syntactic category of programs , and we adjust the grammar of terms accordingly:

The remaining productions for terms as well as the grammars of values and evaluation contexts do not change. However, we introduce a category of program contexts , comprising all evaluation contexts

and make it explicit in the reduction rules below that they give semantics to complete programs by manipulating program contexts. While this modification may seem cosmetic, it reflects the idea of abortive continuations representing “the rest of the computation” and it allows us to introduce, later on in this section, a minimal extension that makes it possible to define sound normal-form bisimulations for the original calculus.

The call-by-value semantics of the calculus is defined by the following rules.

When the capture operator is applied to a value , it makes a copy of the current program context as a value and passes it to . The captured context is reified as a -abstraction whose body is guarded by , which when evaluated removes its enclosing context, effectively restoring as the current program context. Hence the syntactic requirement that be applied to a program and not to an arbitrary term. The semantics of the control operators is illustrated in the following examples.

Example .

Assuming that , we have the following reduction sequence:

Example .

This example illustrates the operational behavior of as a value:

In particular, if , then the value of the initial term is , i.e., the representation of the empty context in the calculus of abortive control. ∎

5.2. Normal-form bisimulation

In the presence of abortive control operators the notion of normal form makes sense only for complete programs. Therefore, in order to define a notion of normal-form bisimulation for the calculus under consideration we need to somehow take into account how two given terms behave in any program context. In order to make such tests possible we introduce a distinct set of context variables, ranged over by , to represent abstract contexts that are a dual concept to the fresh variables used for testing functional values, as argued in Remark 3.1.

We only need to extend the syntax of programs and program contexts:

A program stands for the term plugged in a program context represented by the context variable —we deliberately abuse the notation. Similarly, a program context stands for the context completed with a program context represented by . We write for the set of context variables of a program .

Free variables represent unknown or abstract values in a program and the substitution can be seen as an operation that replaces an abstract value with a concrete value . We define an analogous concretization operation for context variables that we call context substitution: program is a program , where all occurrences of are replaced by . More formally, we have

and for terms the context substitution is applied recursively to its sub-terms and sub-programs. Note that in the first case the substitution plugs the term in the program context . Context substitution preserves reduction.

If , then .

When we substitute for a context variable, this property can be seen as a form of preservation of reduction by program contexts. For example, if with , then , and .

Normal forms of the extended language are either values , open stuck terms , or context-stuck terms of the form . We define progress, bisimulation, and bisimilarity on programs of the extended language, and we define to apply these notions to terms. We change accordingly and we remind the definitions of and .

t s
fresh t s v x w x
x fresh v w F x F’ x
x fresh F F’ F F’
v w F x v F’x w

A relation diacritically progresses to , written , if , , and implies:

  • if , then there exists such that and ;

  • if , then there exists such that ;

  • if , then there exist , such that and ;

  • if , then there exist such that and ;

  • the converse of the above conditions on .

A normal-form bisimulation is a relation such that , and normal-form bisimilarity is the union of all normal-form bisimulations.

In the value case, we do not perform any test on and ; we therefore equate all values when considered as programs. Indeed, our notion of observation is termination of complete programs. In contrast, if , then we require that evaluates to a context-stuck term with the same context variable , and we test the two values by applying them to an ‘abstract value’ in an ‘abstract context.’ Indeed, the program context represented by can either discard the value plugged in it or it can apply it to an argument. Obviously, we cannot equate and if